x11-libs/gdk-pixbuf-2.44.8 — Security Advisories

▸ GLSA 202012-15 GDK-PixBuf: Denial of service this version unaffected low local, remote 2020-12-23

A vulnerability in GDK-PixBuf library could lead to a Denial of Service condition.

Announced: 2020-12-23
Revised: 2020-12-23
Access: local, remote
Bugs: #759094
Advisory: https://security.gentoo.org/glsa/202012-15

Affected packages

Package	Arch	Vulnerable	Unaffected
x11-libs/gdk-pixbuf	*	< 2.42.2	>= 2.42.2

Background

GDK-PixBuf is an image loading library for GTK+.

Description

It was discovered that the GDK-PixBuf library did not properly handle certain GIF images.

Impact

A remote attacker could entice a user to open a specially crafted GIF image in an application linked against GDK-PixBuf library, possibly resulting in a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All GDK-PixBuf library users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-libs/gdk-pixbuf-2.42.2"

References

CVE-2020-29385

▸ GLSA 201804-14 GDK-PixBuf: Remote code execution this version unaffected normal remote 2018-04-17

A vulnerability has been found in GDK-PixBuf that may allow a remote attacker to execute arbitrary code.

Announced: 2018-04-17
Revised: 2018-04-17
Access: remote
Bugs: #644770
Advisory: https://security.gentoo.org/glsa/201804-14

Affected packages

Package	Arch	Vulnerable	Unaffected
x11-libs/gdk-pixbuf	*	< 2.36.11	>= 2.36.11

Background

GDK-PixBuf is an image loading library for GTK+.

Description

Several integer overflows were discovered in GDK-PixBuf’s gif_get_lzw function.

Impact

A remote attacker, by enticing a user to process a specially crafted image file, could execute arbitrary code or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All GDK-PixBuf users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-libs/gdk-pixbuf-2.36.11"

References

CVE-2017-1000422

▸ GLSA 201709-08 GDK-PixBuf: Multiple vulnerabilities this version unaffected normal remote 2017-09-17

Multiple vulnerabilities have been found in GDK-PixBuf, the worst of which could result in the execution of arbitrary code.

Announced: 2017-09-17
Revised: 2017-09-17
Access: remote
Bugs: #592976 #611390 #630026
Advisory: https://security.gentoo.org/glsa/201709-08

Affected packages

Package	Arch	Vulnerable	Unaffected
x11-libs/gdk-pixbuf	*	< 2.36.9	>= 2.36.9

Background

GDK-PixBuf is an image loading library for GTK+.

Description

Multiple vulnerabilities have been discovered in GDK-PixBuf. Please review the referenced CVE identifiers for details.

Impact

A remote attacker, by sending a specially crafted TIFF, JPEG, or URL, could execute arbitrary code with the privileges of the process or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All GDK-PixBuf users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-libs/gdk-pixbuf-2.36.9"

Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.

References

▸ GLSA 201512-05 gdk-pixbuf: Multiple Vulnerabilities this version unaffected normal remote 2015-12-21

Multiple buffer overflow vulnerabilities in gdk-pixbuf may allow remote attackers to execute arbitrary code or cause Denial of Service.

Announced: 2015-12-21
Revised: 2015-12-21
Access: remote
Bugs: #556314 #562878 #562880
Advisory: https://security.gentoo.org/glsa/201512-05

Affected packages

Package	Arch	Vulnerable	Unaffected
x11-libs/gdk-pixbuf	*	< 2.32.1	>= 2.32.1

Background

gdk-pixbuf is an image loading library for GTK+.

Description

Three heap-based buffer overflow vulnerabilities have been discovered in gdk-pixbuf. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could entice a user to open a specially crafted image file with an application linked against gdk-pixbuf, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All gdk-pixbuf users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-libs/gdk-pixbuf-2.32.1"

Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying these packages.

References

▸ GLSA 201206-20 gdk-pixbuf: Denial of service this version unaffected normal remote 2012-06-23

Multiple vulnerabilities in gdk-pixbuf may create a Denial of Service condition.

Announced: 2012-06-23
Revised: 2012-06-23
Access: remote
Bugs: #373999 #412033
Advisory: https://security.gentoo.org/glsa/201206-20

Affected packages

Package	Arch	Vulnerable	Unaffected
x11-libs/gdk-pixbuf	*	< 2.24.1-r1	>= 2.24.1-r1

Background

gdk-pixbuf is an image loading library for GTK+.

Description

Two vulnerabilities have been found in gdk-pixbuf:

The "gdk_pixbuf__gif_image_load()" function in io-gif.c fails to properly handle certain return values from subroutines (CVE-2011-2485).
The "read_bitmap_file_data()" function in io-xbm.c contains an integer overflow error (CVE-2012-2370).

Impact

A remote attacker could entice a user to open a specially crafted image in an application linked against gdk-pixbuf, possibly resulting in Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All gdk-pixbuf users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-libs/gdk-pixbuf-2.24.1-r1"

Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.